diff --git a/src/main/java/com/cloudbees/plugins/credentials/impl/UsernamePasswordCredentialsImpl.java b/src/main/java/com/cloudbees/plugins/credentials/impl/UsernamePasswordCredentialsImpl.java
index 456c0188e..bd6ea06b3 100644
--- a/src/main/java/com/cloudbees/plugins/credentials/impl/UsernamePasswordCredentialsImpl.java
+++ b/src/main/java/com/cloudbees/plugins/credentials/impl/UsernamePasswordCredentialsImpl.java
@@ -79,13 +79,6 @@ public UsernamePasswordCredentialsImpl(@CheckForNull CredentialsScope scope,
         this.password = Secret.fromString(password);
     }
 
-    private Object readResolve() {
-        if (usernameSecret == null) {
-            usernameSecret = true;
-        }
-        return this;
-    }
-
     /**
      * {@inheritDoc}
      */
@@ -104,7 +97,7 @@ public String getUsername() {
 
     @Override
     public boolean isUsernameSecret() {
-        return usernameSecret;
+        return usernameSecret != null ? usernameSecret : true;
     }
 
     @DataBoundSetter
diff --git a/src/test/java/com/cloudbees/plugins/credentials/impl/UsernamePasswordCredentialsImplTest.java b/src/test/java/com/cloudbees/plugins/credentials/impl/UsernamePasswordCredentialsImplTest.java
index 3af27630c..4ff083003 100644
--- a/src/test/java/com/cloudbees/plugins/credentials/impl/UsernamePasswordCredentialsImplTest.java
+++ b/src/test/java/com/cloudbees/plugins/credentials/impl/UsernamePasswordCredentialsImplTest.java
@@ -25,10 +25,13 @@
 package com.cloudbees.plugins.credentials.impl;
 
 import com.cloudbees.plugins.credentials.CredentialsNameProvider;
+import com.cloudbees.plugins.credentials.CredentialsScope;
 import java.util.logging.Level;
+import jenkins.model.Jenkins;
 import org.junit.Test;
 import static org.junit.Assert.*;
 import org.junit.Rule;
+import org.jvnet.hudson.test.Issue;
 import org.jvnet.hudson.test.JenkinsRule;
 import org.jvnet.hudson.test.LoggerRule;
 
@@ -48,4 +51,28 @@ public class UsernamePasswordCredentialsImplTest {
         assertEquals("abc123", CredentialsNameProvider.name(creds));
     }
 
+    @Issue("JENKINS-67132")
+    @Test public void subclassDeserialization() {
+        SpecialUsernamePasswordCredentialsImpl c = (SpecialUsernamePasswordCredentialsImpl) Jenkins.XSTREAM2.fromXML(
+            "<com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImplTest_-SpecialUsernamePasswordCredentialsImpl>\n" +
+            "  <scope>GLOBAL</scope>\n" +
+            "  <id>xxx</id>\n" +
+            "  <username>bob</username>\n" +
+            "  <password>s3cr3t</password>\n" +
+            "</com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImplTest_-SpecialUsernamePasswordCredentialsImpl>");
+        assertTrue(c.initialized);
+        assertEquals("bob", c.getUsername());
+        assertTrue(c.isUsernameSecret());
+    }
+    public static final class SpecialUsernamePasswordCredentialsImpl extends UsernamePasswordCredentialsImpl {
+        public SpecialUsernamePasswordCredentialsImpl(CredentialsScope scope, String id, String description, String username, String password) {
+            super(scope, id, description, username, password);
+        }
+        transient boolean initialized;
+        private Object readResolve() {
+            initialized = true;
+            return this;
+        }
+    }
+
 }